{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in the advisory.\n\nAn attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\n\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\n\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\n\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\n\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n- Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.\n- Scan all data imported into your environment before use to detect potential malware infections.\n- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.\n\nWhen a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.\n\nThe resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.\n\nThe publication of this Cyber Security Advisory is an example of ABB\u2019s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.",
        "title": "Purpose"
      },
      {
        "category": "faq",
        "text": "What causes the vulnerability?\n- The vulnerabilities are caused by the use of SQLite version 3.2.4 in Camera Connect versions up to 2.0.0.42. The root causes vary and are presented in the CVEs in the previous section.\n\nWhat is the affected product or component?\n- The affected component is SQLite version 3.2.4, which is an embedded relational database engine used by Camera Connect versions up to 2.0.0.42.\n\nWhat might an attacker use the vulnerability to do?\n- The potential impacts vary depending on the specific CVE and each one of them are discussed in the previous sections however, it\u0027s important to note that the actual exploitability and impact are significantly reduced by Camera Connect\u0027s deployment in isolated OT networks with restricted access controls.\n\nHow could an attacker exploit the vulnerability?\n- Exploitation methods vary by CVE but generally fall into these categories:\n     1. Database Query Manipulation (Most Common)\n     2. Database Schema Manipulation (Administrative Access Required)\n     3. Malformed Database Files\n     4. Extension-Specific Attacks\n\n   Exploitation Barriers in Camera Connect Deployments:\n     - No direct SQL query interface exposed to users\n     - Parameterized queries and input validation reduce injection risks\n     - Database administrative operations restricted to installation/upgrade processes\n     - Network segmentation limits attacker access to the system\n     - Authentication and authorization controls restrict unauthorized access\n\nCould the vulnerability be exploited remotely?\n- In properly configured Camera Connect deployments following industrial security best practices, remote exploitation is highly unlikely.\n\n   While the CVEs may reference remote exploitation, Camera Connect\u0027s architecture and typical OT deployment model make remote exploitation from outside the control network perimeter extremely difficult. The primary threat vectors are from malicious insiders or compromised systems already within the control network.\n\nCan functional safety be affected by an exploit of this vulnerability?\n- While exploitation of these vulnerabilities could degrade operational monitoring capabilities, properly designed industrial facilities maintain functional safety through independent, dedicated safety systems. Camera Connect should be considered an operational support tool rather than a safety-critical component. Organizations should ensure their safety management systems do not create dependencies on Camera Connect for safety-instrumented functions.\n\nWhat does the update do?\n- The update removes the vulnerability by providing a newer version of the affected component.\n\nWhen this security advisory was issued, had this vulnerability been publicly disclosed?\n- This vulnerability has been publicly disclosed for the 3rd party component, but not for the ABB product using this component\n\nWhen this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?\n- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.\n\n",
        "title": "Frequently Asked Questions"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://www.abb.com/global/en/company/about/cybersecurity/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF Version ",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=4HZM000604\u0026LanguageCode=en\u0026DocumentPartId=PDF\u0026Action=Launch"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF Version ",
        "url": "https://psirt.abb.com/csaf/2026/4hzm000604.json"
      }
    ],
    "title": "ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)",
    "tracking": {
      "current_release_date": "2026-03-26T00:30:00.000Z",
      "generator": {
        "date": "2026-03-26T12:35:09.292Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.46"
        }
      },
      "id": "4HZM000604",
      "initial_release_date": "2026-03-26T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-26T00:30:00.000Z",
          "legacy_version": "A",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=2.0.0.42",
                "product": {
                  "name": "ABB Ability Camera Connect \u003c=2.0.0.42",
                  "product_id": "AV1"
                }
              },
              {
                "category": "product_version",
                "name": "2.0.0.49",
                "product": {
                  "name": "ABB Ability Camera Connect 2.0.0.49",
                  "product_id": "FX1"
                }
              }
            ],
            "category": "product_name",
            "name": "Ability Camera Connect"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-7104",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-7104 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7104"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects the SQLite session extension (FTS3), which is an optional component:\n- Component Usage: Camera Connect\u0027s implementation do not utilize the SQLite session extension functionality, rendering this vulnerability non-applicable to the actual deployment.\n- Adjacent Network Attack: The CVSS vector indicates Adjacent Network access (AV:A) is required, meaning the attacker must be on the same local network segment. In OT environments, network segmentation at ISA-95 Level 2 restricts access to authorized personnel only.\n- Authentication Required: Low privilege credentials (PR:L) are still required to exploit this vulnerability, providing an additional barrier in Camera Connect\u0027s access-controlled environment.\n- Limited Impact: The CVSS score of 5.5 (MEDIUM) reflects limited impact to confidentiality, integrity, and avail-ability (C:L/I:L/A:L).\n- Extension-Specific: The vulnerability is in the make all test handler of the session extension, which is typically not used in production deployments.\n\nCamera Connect\u0027s restricted operational environment and limited use of optional SQLite features significantly reduce the exploitability of this vulnerability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2023-7104"
    },
    {
      "cve": "CVE-2022-35737",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-35737 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35737"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability has specific prerequisites that limit its applicability to Camera Connect:\n- Resource Requirements: The vulnerability requires \"billions of bytes\" to be used in a string argument, representing an extreme edge case that exceeds typical operational parameters in industrial control systems.\n- C API Specific: This vulnerability affects direct C API calls to SQLite. Camera Connect uses higher-level database access patterns through managed code or SQL queries, not direct low-level C API manipulation.\n- Memory Constraints: Industrial systems running Camera Connect typically operate within defined memory boundaries and resource allocation limits that would prevent the allocation of multi-gigabyte strings.\n- Input Validation: Application-level input validation and size restrictions in Camera Connect prevent the sub-mission of abnormally large data values.\n- Practical Impossibility: In the context of Camera Connect\u0027s use case (camera connectivity and video management), there are no legitimate operational scenarios requiring billion-byte string parameters.\n\nThe extreme resource requirements and specific attack vector make this vulnerability impractical to exploit in Camera Connect\u0027s typical deployment environment.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2022-35737"
    },
    {
      "cve": "CVE-2020-15358",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap over-flow because of misuse of transitive properties for constant propagation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-15358 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves specific SQL query patterns and optimization edge cases:\n- Query Complexity: The vulnerability requires specific use of complex multi-select queries with ORDER BY clauses that trigger the query-flattener optimization. Camera Connect\u0027s database queries are typically straight-forward CRUD operations for camera configuration and video metadata.\n- Limited Query Construction: Users of Camera Connect do not have direct SQL query construction capabilities; all database interactions occur through the application\u0027s predefined data access layer.\n- Query Review: Database queries in Camera Connect are part of the application codebase and undergo development review and testing, reducing the likelihood of crafted malicious query patterns.\n- Heap Overflow Protection: Modern operating systems and runtime environments include heap overflow protection mechanisms that can detect and prevent exploitation attempts.\n- Operational Context: The specific query pattern required to trigger this vulnerability is unlikely to occur in Camera Connect\u0027s operational use cases related to camera management and video streaming.\n\nThe constrained database access model and typical query patterns in Camera Connect operations make this vulnerability extremely unlikely to be triggered in practice.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-15358"
    },
    {
      "cve": "CVE-2020-13632",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13632 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13632"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects the SQLite Full-Text Search (FTS3) extension with specific conditions:\n- FTS3 Extension: Camera Connect do not utilize SQLite\u0027s Full-Text Search capabilities, as the solution is primarily focused on camera connectivity, configuration, and video management rather than full-text search operations.\n- Specific Function: The vulnerability requires use of the matchinfo() function, which is a specialized FTS3 query function which is not part of Camera Connect\u0027s database access patterns.\n- Denial of Service Impact: This is a NULL pointer dereference leading to application crash (denial of service), not remote code execution. In an OT environment, application crashes are detected and can trigger automatic restart mechanisms.\n- Access Control: Crafting the specific malicious query would require authenticated database access and knowledge of the database schema.\n- Feature-Specific: The FTS3 is not enabled or compiled into the SQLite build used by Camera Connect, so this vulnerability is not present.\n\nThe specialized nature of this vulnerability and its limitation to a specific extension function that Camera Connect likely does not utilize significantly reduces the risk.\n\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13632"
    },
    {
      "cve": "CVE-2020-13631",
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13631 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13631"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves database schema manipulation:\n- Administrative Privilege Requirement: Renaming tables requires database administrative privileges, which are not granted to normal Camera Connect users.\n- Virtual Table Usage: This vulnerability specifically affects virtual tables, which are an advanced SQLite feature. Camera Connect\u0027s database schema uses standard tables for its operational data.\n- Schema Stability: In industrial OT environments, database schemas are static and controlled through formal change management processes. Dynamic table creation and renaming are not typical operational activities.\n- Limited Impact: Even if exploited, the impact is primarily on database integrity rather than system availability or confidentiality. Database backups and recovery procedures in industrial environments provide restoration capabilities.\n- Application Logic: Camera Connect\u0027s application layer mediates all database interactions, preventing direct DDL (Data Definition Language) operations by end users.\n\nThe requirement for administrative access and the uncommon use case of dynamic schema modification in OT environments make this vulnerability low risk for Camera Connect.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13631"
    },
    {
      "cve": "CVE-2020-13630",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13630 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13630"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This is another FTS3 extension-specific vulnerability:\n- FTS3 Extension Dependency: The vulnerability exists only in the FTS3 (Full-Text Search) extension. Camera Connect does not enable or use FTS3 functionality, so this vulnerability is not applicable.\n- Snippet Feature: The use-after-free specifically affects the snippet feature of FTS3, which generates text snip-pets from search results - a specialized feature unlikely to be required in Camera Connect\u0027s video management operations.\n- Memory Management: Modern operating systems and runtime environments include heap management protections that can detect use-after-free conditions and prevent exploitation.\n- Crash vs. Exploitation: While use-after-free vulnerabilities can potentially lead to code execution, successful exploitation requires precise memory manipulation. The more likely outcome is application crash (denial of service).\n- Function-Specific: The vulnerability is in fts3EvalNextRow, a specific internal function that would only be triggered through specialized FTS3 queries.\n\nCamera Connect\u0027s non-existent use of advanced FTS3 features significantly reduces exposure to this vulnerability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13630"
    },
    {
      "cve": "CVE-2020-13435",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13435 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13435"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability results in a segmentation fault (application crash):\n- Denial of Service Impact: A segmentation fault leads to application crash, representing a denial of service rather than data breach or code execution. In industrial environments, application monitoring and automatic re-start mechanisms can quickly restore service.\n- Query Complexity: The vulnerability requires specific expression patterns in SQL queries. Camera Connect\u0027s predefined query templates and parameterized queries reduce the likelihood of triggering this condition.\n- High Availability Design: OT solutions typically incorporate redundancy and failover mechanisms to maintain operational continuity in the event of application failures.\n- Limited Window: In a segmentation fault scenario, the application terminates immediately, limiting any potential data exposure compared to vulnerabilities that allow sustained unauthorized access.\n- Operational Monitoring: Industrial control systems maintain operational monitoring that alerts operators to application failures, enabling rapid response.\n\nWhile denial of service is undesirable in OT environments, the impact is significantly less severe than vulnerabilities allowing unauthorized access or data manipulation.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13435"
    },
    {
      "cve": "CVE-2020-13434",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13434 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13434"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects SQLite\u0027s internal printf functionality:\n- Internal Function: The vulnerability is in sqlite3_str_vappendf, an internal string formatting function. Camera Connect\u0027s use of SQLite typically occurs through higher-level database operations that don\u0027t directly expose this function.\n- Integer Overflow Requirements: Triggering an integer overflow requires carefully crafted input with extreme values, which would be constrained by Camera Connect\u0027s input validation and data type definitions.\n- Format String Context: The vulnerability occurs in printf-style formatting operations. Camera Connect\u0027s data-base interactions use parameterized queries and typed data binding rather than format string operations.\n- Bounds Checking: Application-level data validation limits the size and format of values passed to database operations, preventing the extreme conditions necessary to trigger this overflow.\n- Limited Exposure: The specific code path would need to be triggered through very specific database operations that may not occur in Camera Connect\u0027s normal operational workflow.\n\nThe internal nature of this vulnerability and Camera Connect\u0027s structured data access patterns make exploitation highly unlikely in practice.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13434"
    },
    {
      "cve": "CVE-2020-11656",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-11656 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11656"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves database schema modification operations:\n- Schema Modification: The vulnerability is in ALTER TABLE operations. In OT environments, database schemas are static and managed through controlled change management processes, not dynamic runtime modifications.\n- Administrative Operation: ALTER TABLE requires elevated database privileges that are not granted to regular Camera Connect users or operational personnel.\n- Compound Query Requirement: The vulnerability specifically requires a compound SELECT statement with ORDER BY clause in the context of ALTER TABLE - an unusual and non-standard SQL pattern.\n- Application-Mediated Access: Camera Connect does not provide interfaces for direct SQL execution or schema modification to end users.\n- Static Schema: Camera Connect\u0027s database schema is established during installation and remains stable throughout operational use, with updates only occurring during planned software upgrades.\n\nThe administrative nature of ALTER TABLE operations and the absence of dynamic schema modification in normal Cam-era Connect usage effectively eliminate this attack vector.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-11656"
    },
    {
      "cve": "CVE-2020-11655",
      "cwe": {
        "id": "CWE-665",
        "name": "Improper Initialization"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object\u0027s initialization is mishandled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-11655 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11655"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves SQL window functions:\n- Window Function Usage: Window functions (e.g., ROW_NUMBER(), RANK(), LAG()) are advanced SQL features primarily used in analytical queries. Camera Connect\u0027s operational database queries typically use simpler CRUD operations and aggregations.\n- Denial of Service Only: The impact is a segmentation fault causing application crash, not data breach or code execution. In industrial environments, service interruption is managed through monitoring and automatic restart capabilities.\n- Query Complexity: Crafting a malformed window function query requires knowledge of the database schema and specific query construction - not accessible through Camera Connect\u0027s standard user interfaces.\n- Controlled Environment: In ISA-95 Level 2 deployments, any application crashes are immediately visible to operators and can be investigated through system logs and monitoring.\n- Feature Utilization: Camera Connect\u0027s queries do not utilize window functions, so this attack vector is not present in the application.\n\nThe specialized nature of window functions and the controlled operational environment limit the practical impact of this vulnerability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-11655"
    },
    {
      "cve": "CVE-2019-19646",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "description",
          "text": "pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2019-19646 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves SQLite\u0027s PRAGMA commands and generated columns:\n- PRAGMA Commands: PRAGMA commands are administrative database commands typically not accessible to end users. Camera Connect\u0027s application layer would not expose PRAGMA command execution to operators.\n- Integrity Check Context: The vulnerability specifically affects the integrity_check PRAGMA, which is a database maintenance operation typically performed during development or maintenance windows, not during normal operation.\n- Limited Impact: Mishandling of NOT NULL in integrity checks would primarily affect database validation results rather than causing security breaches or service disruption.\n- Administrative Access Required: Execution of PRAGMA commands requires direct database access at an ad-ministrative level, which is restricted in production OT environments.\n\nThe specialized nature of this vulnerability and its limitation to administrative database maintenance operations make it non-applicable to Camera Connect\u0027s normal operational use.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2019-19646"
    },
    {
      "cve": "CVE-2019-19645",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "description",
          "text": "alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2019-19645 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19645"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves database views and schema modification:\n- View Usage: This vulnerability requires self-referential database views, which are advanced database con-structs. Camera Connect\u0027s database schema uses standard tables and simple views without self-referential patterns.\n- ALTER TABLE Requirement: Triggering the vulnerability requires ALTER TABLE operations, which are administrative schema modification commands not available to normal users.\n- Infinite Recursion Detection: Modern operating systems and runtime environments typically include stack overflow protection and recursion detection that can terminate runaway processes.\n- Schema Design: Self-referential views represent poor database design practices that would be identified and corrected during development review.\n- Static Schema: Camera Connect\u0027s database schema is static and managed through formal change control, pre-venting the introduction of problematic self-referential view patterns.\n\nThe requirement for both specialized view design and administrative schema modification makes this vulnerability in-applicable to Camera Connect\u0027s operational environment.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2019-19645"
    },
    {
      "cve": "CVE-2018-20506",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer over-flow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20506 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20506"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects the FTS3 extension with specific attack requirements:\n- FTS3 Extension: Camera Connect do not utilize the Full-Text Search extension, making this vulnerability non-applicable.\n- Shadow Table Manipulation: The vulnerability requires crafted changes to FTS3 \"shadow tables\" (internal tables supporting FTS3 indexes). These shadow tables are not exposed through normal database operations and require direct low-level database access.\n- Multi-Step Attack: Exploitation requires multiple steps: enable FTS3, manipulate shadow tables, and then trig-ger a merge operation - each requiring specific database access and knowledge.\n- ISA-95 Level 2 Deployment: The \"remote attackers\" scenario is mitigated by network segmentation. Camera Connect operates in isolated control networks without direct internet exposure.\n\nThe combination of FTS3-specific requirements, shadow table manipulation, and network isolation makes this vulnerability low risk for Camera Connect deployments.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20506"
    },
    {
      "cve": "CVE-2018-20505",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20505 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20505"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability is classified as CWE-89 (SQL Injection) in NVD, but exploitation still requires SQL execution paths that are not exposed in normal Camera Connect operation:\n- Database Schema Validation: Camera Connect\u0027s database schema is established during installation and vali-dated through testing. A malformed PRIMARY KEY would be detected during development and corrected be-fore deployment.\n- DDL Access: Creating or modifying PRIMARY KEY constraints requires database administrative privileges and DDL (Data Definition Language) access, which is not available to normal Camera Connect users.\n- SQL Injection Controls: Camera Connect uses parameterized queries and controlled query templates, which significantly reduce the likelihood of user-controlled SQL construction required for SQL injection exploitation.\n- Denial of Service Impact: The vulnerability leads to application crash rather than data breach or code execution. Industrial environments include application monitoring and automatic restart capabilities to maintain service availability.\n- Static Schema: Camera Connect\u0027s database schema remains static throughout operational use, with PRIMARY KEY definitions established and validated during initial installation.\n\nThe combination of SQL injection controls, restricted DDL access, and static schema management makes this vulnerability low risk in properly deployed Camera Connect systems.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20505"
    },
    {
      "cve": "CVE-2018-20346",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer over-flow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20346 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20346"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This is the \"Magellan\" vulnerability, related to CVE-2018-20506:\n- FTS3 Extension: The vulnerability only affects installations where the FTS3 (Full-Text Search) extension is enabled. Camera Connect do not require or enable this extension.\n- Shadow Table Manipulation: Exploitation requires direct manipulation of FTS3 shadow tables, which are in-ternal implementation details not exposed through standard SQL interfaces.\n- Arbitrary SQL Execution: The attack requires the \"ability to run arbitrary SQL statements.\" Camera Connect uses parameterized queries and does not provide SQL injection points or direct SQL execution capabilities to users.\n- OT Network Isolation: The \"remote attackers\" threat model is mitigated by ISA-95 Level 2 network segmentation, which isolates the control network from external access.\n- Multi-Stage Attack: Successful exploitation requires multiple prerequisites: FTS3 enabled, ability to modify shadow tables, and ability to execute queries - each representing a significant barrier.\n\nThe specialized attack requirements and Camera Connect\u0027s deployment architecture make this high-profile vulnerability low risk in practice.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20346"
    },
    {
      "cve": "CVE-2018-8740",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-8740 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8740"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves database schema corruption:\n- Schema Corruption: The vulnerability requires a corrupted database schema created via a CREATE TABLE AS statement. Camera Connect\u0027s database schema is established through controlled installation processes with validation and integrity checks.\n- DDL Access: CREATE TABLE statements require database administrative privileges, which are not available to normal Camera Connect users or operators.\n- NULL Pointer Dereference: The impact is a NULL pointer dereference causing application crash (denial of service), not data breach or code execution.\n- Database Integrity: Modern database deployments include integrity checking mechanisms that can detect corrupted schemas. Camera Connect likely includes database validation during startup.\n- Backup and Recovery: Industrial OT environments maintain database backups and recovery procedures that can restore a clean database schema if corruption is detected.\n\nThe requirement for database administrative access and the protective mechanisms around database schema integrity make this vulnerability low priority for Camera Connect deployments.\n\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-8740"
    },
    {
      "cve": "CVE-2017-10989",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2017-10989 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10989"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects SQLite\u0027s R Tree extension:\n- R Tree Extension: This vulnerability is specific to the RTree (R-Tree spatial index) extension of SQLite. Camera Connect do not utilize spatial indexing capabilities, making this extension inactive.\n- Crafted Database Requirement: The vulnerability requires a specially crafted database with malformed RTree blobs. Camera Connect\u0027s database is generated and maintained by the application itself, not loaded from ex-ternal sources.\n- Spatial Data: RTree indexes are used for spatial data queries (geographic/geometric data). Camera Connect\u0027s use case involves camera management and video streaming, which typically does not require spatial indexing.\n- Limited Exposure: The vulnerability requires both the RTree extension to be enabled and specific malformed data structures within the database.\n- Database Source Control: In OT environments, databases come from trusted sources and are protected by integrity checking mechanisms.\n\nCamera Connect does not use the RTree extension, so this vulnerability is not applicable. Even if the extension is pre-sent, the controlled database environment significantly reduces risk.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2017-10989"
    },
    {
      "cve": "CVE-2016-6153",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other im-pact by leveraging use of the current working directory for temporary files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2016-6153 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6153"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects temporary file handling on Unix-based systems:\n- Windows Deployment: Camera Connect is primarily deployed on Windows operating systems in industrial environments (note: the vulnerability description specifically references os_unix.c). Windows-based deployments are not affected by this Unix-specific implementation issue.\n- Local Access Required: The CVE describes \"local users\" as the threat actors, requiring authenticated local sys-tem access. In OT environments, local system access is restricted to authorized administrators.\n- Temporary File Usage: The vulnerability relates to temporary file creation. Modern SQLite versions and Camera Connect\u0027s configuration may specify explicit temporary directory locations rather than relying on the de-fault search algorithm.\n- File System Permissions: Windows operating systems used in industrial environments typically implement proper file system permissions and user access controls.\n- Sensitive Information Exposure: Any sensitive information in temporary files would be limited to transient database operations and would not include long-term sensitive data.\n\nThe Unix-specific nature of this vulnerability and Camera Connect\u0027s typical deployment on Windows systems significantly reduces applicability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2016-6153"
    },
    {
      "cve": "CVE-2015-6607",
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-6607 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6607"
        },
        {
          "category": "external",
          "summary": "NVD CVSS v2.0 Calculator\n- CVSS v2.0 Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P\n- CVSS v2.0 Base Score : 6.8 ",
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:M/Au:N/C:P/I:P/A:P)"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability is specific to Android environments:\n- Platform-Specific: This CVE specifically affects Android operating systems (before version 5.1.1 LMY48T). Camera Connect is a Windows-based application for industrial environments, not an Android mobile application.\n- Different Attack Surface: The vulnerability involves Android\u0027s application sandbox and privilege model, which is fundamentally different from Windows desktop application security.\n- Application Context: As noted in the CVE description, it\u0027s \"internal bug 20099586\" - an Android-specific internal vulnerability in how Android handled SQLite.\n- Non-Applicable Platform: Since Camera Connect operates on Windows systems in OT environments rather than Android mobile devices, this CVE does not apply to Camera Connect deployments.\n\nThis CVE is effectively not relevant to Camera Connect due to platform incompatibility.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-6607"
    },
    {
      "cve": "CVE-2015-5895",
      "notes": [
        {
          "category": "description",
          "text": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-5895 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5895"
        },
        {
          "category": "external",
          "summary": "NVD CVSS v2.0 Calculator \n- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C\n- CVSS v2.0 Base Score : 10 ",
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C)"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This CVE has limited public information:\n- Platform-Specific Context: these vulnerabilities were identified and fixed in the context of mobile iOS devices. Camera Connect operates on Windows platforms in industrial environments.\n- Unspecified Details: The CVE notes \"unspecified vulnerabilities\" with \"unknown impact and attack vectors,\" suggesting these may be vendor-specific issues in Apple\u0027s SQLite implementation or integration rather than core SQLite vulnerabilities.\n- Mobile vs. Desktop: iOS and desktop Windows environments have fundamentally different security models, application sandboxing, and attack surfaces.\n- Apple-Specific Fixes: These vulnerabilities were addressed in iOS 9 through Apple-specific patches, which may have included iOS-specific security hardening rather than core SQLite fixes.\n- Limited Applicability: Without specific attack vector information, and given the iOS-specific context, there is insufficient evidence that these vulnerabilities affect Camera Connect on Windows platforms.\n\nThe mobile platform-specific nature and lack of detailed vulnerability information make risk assessment and mitigation difficult, but the platform differences suggest limited applicability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-5895"
    },
    {
      "cve": "CVE-2015-3717",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-3717 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3717"
        },
        {
          "category": "external",
          "summary": "NVD CVSS v2.0 Calculator\n- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P\n- CVSS v2.0 Base Score : 7.5 ",
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability affects printf functionality in Apple platforms:\n- Apple Platform Context: The CVE specifically references Apple iOS and OS X implementations. Camera Connect runs on Windows operating systems, which may have different SQLite implementations and security controls.\n- Printf Functionality: The vulnerability is in printf functionality, which is internal string formatting. Camera Connect uses parameterized database queries and typed data operations, limiting exposure to format string vulnerabilities.\n- Remote Attackers: The CVE mentions \"remote attackers,\" but Camera Connect operates in isolated ISA-95 Level 2 networks with no direct remote access from the internet.\n- Apple-Specific Fixes: The vulnerability was addressed through Apple platform-specific security updates, which may have included platform-specific protections not present in or needed for Windows deployments.\n- String Handling: Modern development practices in Camera Connect likely use safe string handling APIs and input validation that reduce exposure to buffer overflow conditions.\n\nThe Apple platform-specific nature of this CVE and Camera Connect\u0027s Windows deployment environment suggest limited cross-platform applicability.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-3717"
    },
    {
      "cve": "CVE-2015-3416",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer over-flow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-3416 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3416"
        },
        {
          "category": "external",
          "summary": "NVD CVSS v2.0 Calculator\n- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P\n- CVSS v2.0 Base Score : 7.5 ",
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves printf-style formatting in SQL SELECT statements:\n- Query Control: The vulnerability requires crafting specific printf function calls with very large integer precision/width values within SELECT statements. Camera Connect\u0027s SQL queries are generated by the application code, not provided directly by untrusted users.\n- Input Validation: Any user inputs that influence query parameters undergo validation and sanitization before being incorporated into SQL statements, limiting the ability to inject malicious printf patterns.\n- Parameterized Queries: Camera Connect uses parameterized queries and prepared statements where possible, reducing exposure to SQL injection vectors that could be used to introduce malicious printf calls.\n- Limited printf Usage: The vulnerability specifically affects printf-style formatting functions in SQLite. Camera Connect\u0027s typical query patterns do not extensively use printf-style formatting operations.\n- Stack Overflow Detection: Modern compiler protections (stack canaries, ASLR) and operating system safe-guards provide additional defense-in-depth against stack-based buffer overflow exploitation.\n\nThe controlled nature of SQL query generation in Camera Connect, combined with input validation and parameterized query usage, significantly reduces the practical exploitability of this vulnerability in production deployments.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-3416"
    },
    {
      "cve": "CVE-2015-3415",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "description",
          "text": "The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0\u0026O\u003eO) in a CREATE TABLE statement.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-3415 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3415"
        },
        {
          "category": "external",
          "summary": "NVD CVSS v2.0 Calculator\n- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P\n- CVSS v2.0 Base Score : 7.5 ",
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "This vulnerability involves malformed CHECK constraints that can trigger improper resource release behavior (CWE-404):\n- CHECK Constraint: The vulnerability requires a malformed CHECK constraint in a CREATE TABLE statement, such as CHECK(0\u0026O\u003eO). CHECK constraints are part of database schema definition, not runtime queries.\n- DDL Access Required: Creating or modifying tables with CHECK constraints requires database administrative privileges and DDL access, which is not available to normal Camera Connect users.\n- Schema Validation: Camera Connect\u0027s database schema is established during installation and undergoes vali-dation testing. Malformed CHECK constraints would be identified and corrected during development.\n- Static Schema: Camera Connect uses a predefined database schema that is not dynamically generated or modified during normal operation. New table creation does not occur during runtime.\n- Development Detection: The specific CHECK constraint pattern (bitwise operation in comparison) is clearly malformed and would be detected by code review and database testing procedures.\n- DoS Containment: Even if triggered, impact is typically process-level instability (invalid free/crash). OT deployments mitigate this with service monitoring, restart policies, and incident response procedures.\n\nThe requirement for schema-level modification access and the static nature of Camera Connect\u0027s database design effectively eliminate this vulnerability in deployed systems.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-3415"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2025-6965 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "FIRST CVSS v4.0 Calculator \n- CVSS v4.0 Vector : AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green\n- CVSS v4.0 Base Score : 7.2 ",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Camera Connect is deployed as an OT solution typically operating in ISA-95 Level 2 (control/supervisory level) environments. This deployment architecture provides inherent risk mitigation:\n- Network Segmentation: The solution operates within isolated industrial control networks, separated from IT networks and the internet by firewalls and demilitarized zones (DMZs).\n- Access Control: Access to the Camera Connect system is restricted to authorized plant operators and maintenance personnel through role-based access controls and authentication mechanisms.\n- Limited Attack Surface: The CVSS v4.0 vector indicates Network attack vector (AV:N), High attack complexity (AC:H), and requires Low privileges (PR:L), significantly reducing the likelihood of exploitation in a controlled OT environment.\n- Physical Security: Level 2 systems are typically located in secure facilities with physical access controls.\n- Operational Monitoring: Industrial environments maintain operational monitoring that can detect anomalous behavior.\n\nGiven these factors, successful exploitation would require an authenticated attacker with specific knowledge of the system, positioned within the control network, making this vulnerability Low risk in properly segmented OT deployments.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-3277",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow can be triggered in SQLite\u0027s concat_ws() function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild heap buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2025-3277 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3277"
        },
        {
          "category": "external",
          "summary": "FIRST CVSS v4.0 Calculator\n- CVSS v4.0 Vector : AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L\n- CVSS v4.0 Base Score : 6.9 ",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n- ABB Ability Camera Connect 2.0.0.49.\nThe easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "While this vulnerability has a CVSS v4.0 score of 6.9 and theoretically allows arbitrary code execution, Camera Connect\u0027s deployment model provides significant protection:\n- Function-Specific Vulnerability: The vulnerability requires specific use of the concat_ws() SQL function, which is not utilized in Camera Connect\u0027s standard database operations.\n- Input Validation: Camera Connect implements input validation and sanitization mechanisms that limit the ability to craft malicious SQL queries.\n- Network Isolation: As an ISA-95 Level 2 OT solution, Camera Connect operates within protected industrial networks with limited external connectivity.\n- Authenticated Access Required: Database operations in Camera Connect require user authentication and are performed within the context of the application\u0027s business logic rather than through direct user-supplied SQL.\n- Memory Protection: Modern operating systems deployed in industrial environments typically include memory protection mechanisms (DEP, ASLR) that make heap exploitation more difficult.\n\nThe risk is further reduced by operational procedures requiring change management and validation testing before any modifications to the system configuration or database queries.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2025-3277"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component.\n\nAlthough no successful exploitation was observed during testing of the affected B\u0026R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.\n",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local B\u0026R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.\n\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.\n\n",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by B\u0026R.\n\nB\u0026R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B\u0026R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B\u0026R or its suppliers have been advised of the possibility of such damages.\n\nThis document and parts hereof must not be reproduced or copied without written permission from B\u0026R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\n\nAll rights to registrations and trademarks reside with their respective owners.",
        "title": "Notice"
      },
      {
        "category": "other",
        "text": "For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\n\u2013 Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general purpose network (e.g. office or home networks).\n\n\u2013 Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n\n\u2013 Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.\n\n\u2013 Scan all data imported into your environment before use to detect potential malware infections.\n\n\u2013 Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n\n\u2013 Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n\n\u2013 When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\n\nMore information on recommended practices can be found in the following documents:\n\nDefense in Depth for B\u0026R products - https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf\n",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "B\u0026R has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.\n\nWhen a potential product vulnerability is identified or reported, B\u0026R immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.\n\nThe resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If B\u0026R is aware of any specific threats, it will be clearly mentioned in the communication.\n\nThe publication of this Cyber Security Advisory is an example of B\u0026R\u2019s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.",
        "title": "Purpose"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://www.abb.com/global/en/company/about/cybersecurity/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF Version ",
        "url": "https://www.br-automation.com/fileadmin/SA25P007-097a386d.pdf"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF Version ",
        "url": "https://psirt.abb.com/csaf/2026/sa25p007.json"
      }
    ],
    "title": "B\u0026R Automation Studio Update of SQLite version",
    "tracking": {
      "current_release_date": "2026-02-18T00:30:00.000Z",
      "generator": {
        "date": "2026-02-18T11:44:03.289Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.43"
        }
      },
      "id": "SA25P007",
      "initial_release_date": "2026-02-18T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2026-02-18T00:30:00.000Z",
          "legacy_version": "A",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.5",
                "product": {
                  "name": "ABB B\u0026R Automation Studio \u003c6.5",
                  "product_id": "AV1"
                }
              },
              {
                "category": "product_version",
                "name": "6.5",
                "product": {
                  "name": "ABB B\u0026R Automation Studio 6.5",
                  "product_id": "FX1"
                }
              }
            ],
            "category": "product_name",
            "name": "B\u0026R Automation Studio"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2025-6965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-3277",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow vulnerability exists in SQLite\u0027s concat_ws() function that can lead to a massive heap buffer overflow. When triggered, the integer overflow results in a truncated size value being used for buffer allocation, while the original untruncated size is used for writing the resulting string, causing a heap buffer overflow of approximately 4GB.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2025-3277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3277"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2025-3277"
    },
    {
      "cve": "CVE-2023-7104",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-7104",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7104"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6.6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2023-7104"
    },
    {
      "cve": "CVE-2022-35737",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-35737",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35737"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2022-35737"
    },
    {
      "cve": "CVE-2020-15358",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-15358",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-15358"
    },
    {
      "cve": "CVE-2020-13632",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13632",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13632"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13632"
    },
    {
      "cve": "CVE-2020-13631",
      "cwe": {
        "id": "CWE-286",
        "name": "Incorrect User Management"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13631"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13631"
    },
    {
      "cve": "CVE-2020-13630",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13630",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13630"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13630"
    },
    {
      "cve": "CVE-2020-13435",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13435",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13435"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13435"
    },
    {
      "cve": "CVE-2020-13434",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-13434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13434"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-13434"
    },
    {
      "cve": "CVE-2020-11656",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-11656",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11656"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-11656"
    },
    {
      "cve": "CVE-2020-11655",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object\u0027s initialization is mishandled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2020-11655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11655"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2020-11655"
    },
    {
      "cve": "CVE-2019-19646",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "description",
          "text": "pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2019-19646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2019-19646"
    },
    {
      "cve": "CVE-2019-19645",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "description",
          "text": "alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2019-19645",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19645"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2019-19645"
    },
    {
      "cve": "CVE-2019-8457",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2019-8457",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8457"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2019-8457"
    },
    {
      "cve": "CVE-2018-20506",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allow-ing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20506"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.3,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20506"
    },
    {
      "cve": "CVE-2018-20505",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20505",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20505"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20505"
    },
    {
      "cve": "CVE-2018-20346",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-20346",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20346"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.3,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-20346"
    },
    {
      "cve": "CVE-2018-8740",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2018-8740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8740"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2018-8740"
    },
    {
      "cve": "CVE-2017-10989",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mis-handles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly un-specified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2017-10989",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10989"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2017-10989"
    },
    {
      "cve": "CVE-2016-6153",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2016-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6153"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2016-6153"
    },
    {
      "cve": "CVE-2015-6607",
      "cwe": {
        "id": "CWE-286",
        "name": "Incorrect User Management"
      },
      "notes": [
        {
          "category": "description",
          "text": "SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-6607",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6607"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "environmentalScore": 3.4,
            "environmentalSeverity": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.4,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-6607"
    },
    {
      "cve": "CVE-2015-5895",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown im-pact and attack vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-5895",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5895"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-5895"
    },
    {
      "cve": "CVE-2015-3717",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via un-specified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-3717",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3717"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-3717"
    },
    {
      "cve": "CVE-2015-3416",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2015-3416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3416"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product versions:\n\nB\u0026R Automation Studio 6.5\n\nB\u0026R recommends that customers apply the update at earliest convenience.\n\nThe process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Refer to section \u201cGeneral security recommendations\u201d for advice on how to keep your system secure.",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2015-3416"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Junos OS NFX Series versions ant\u00e9rieures \u00e0 20.2R1",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions ant\u00e9rieures \u00e0 12.3R12-S16, 12.3X48-D105, 14.1X53-D53, 15.1R7-S8, 15.1X49-D220, 15.1X53-D593, 16.1R7-S8, 16.2R2-S11, 17.1R2-S11, 17.2R3-S4, 17.2X75-D45, 17.3R3-S9, 17.4R2-S12, 17.4R3-S3, 18.1R3-S10, 18.2R2-S7, 18.2R3S6, 18.2X75-D435, 18.3R1-S7, 18.3R2-S4, 18.3R3-S3, 18.4R1-S7, 18.4R2-S5, 18.4R3-S4, 19.1R1-S5, 19.1R2-S2, 19.1R3-S2, 19.2R1-S5, 19.2R2, 19.3R2-S3, 19.3R3, 19.4R1-S3, 19.4R2-S1, 19.4R3, 20.1R1-S2, 20.1R2, 20.2R1",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Secure Analytics versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "Secure Analytics",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Networks Junos Space et Junos Space Security Director versions ant\u00e9rieures \u00e0 20.2R1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS MX series et EX9200 Series versions ant\u00e9rieures \u00e0 17.2R3-S4, 17.2X75-D102, 17.2X75-D110, 17.3R3-S8, 17.4R2-S11, 17.4R3-S2, 18.2R2-S7, 18.2R3, 18.2R3-S3, 18.2X75-D30, 18.3R2-S4, 18.3R3-S2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Networks Junos OS Evolved versions ant\u00e9rieures \u00e0 20.1R2-EVO",
      "product": {
        "name": "Networks Junos OS Evolved",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS NFX150, SRX1500, SRX4100, SRX4200, vSRX versions ant\u00e9rieures \u00e0 15.1X49-D220, 17.4R3-S3, 18.1R3-S11, 18.2R3-S5, 18.3R2-S4, 18.3R3-S3, 18.4R2-S5, 18.4R3-S4, 19.1R3-S2, 19.2R1-S5, 19.2R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS SRX Series versions ant\u00e9rieures \u00e0 12.3X48-D90, 15.1X49-D190, 17.4R2-S9, 17.4R3, 18.1R3-S9, 18.2R3, 18.3R1-S7, 18.3R2-S3, 18.3R3, 18.4R1-S6, 18.4R2-S3, 18.4R3, 19.1R1-S4, 19.1R2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS MX Series versions ant\u00e9rieures \u00e0 17.3R3-S8, 18.3R3-S1, 18.4R3, 19.1R3, 19.2R2, 19.3R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-1661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1661"
    },
    {
      "name": "CVE-2020-7450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7450"
    },
    {
      "name": "CVE-2015-3416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3416"
    },
    {
      "name": "CVE-2019-15875",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-15875"
    },
    {
      "name": "CVE-2015-3415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3415"
    },
    {
      "name": "CVE-2019-11478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11478"
    },
    {
      "name": "CVE-2008-6592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6592"
    },
    {
      "name": "CVE-2019-9936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-9936"
    },
    {
      "name": "CVE-2020-1657",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1657"
    },
    {
      "name": "CVE-2020-1682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1682"
    },
    {
      "name": "CVE-2019-5599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5599"
    },
    {
      "name": "CVE-2013-7443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-7443"
    },
    {
      "name": "CVE-2018-8740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8740"
    },
    {
      "name": "CVE-2015-6607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-6607"
    },
    {
      "name": "CVE-2018-20506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20506"
    },
    {
      "name": "CVE-2018-20346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20346"
    },
    {
      "name": "CVE-2015-5895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5895"
    },
    {
      "name": "CVE-2015-3414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3414"
    },
    {
      "name": "CVE-2019-11135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11135"
    },
    {
      "name": "CVE-2020-10188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10188"
    },
    {
      "name": "CVE-2019-8457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8457"
    },
    {
      "name": "CVE-2017-13685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-13685"
    },
    {
      "name": "CVE-2019-5018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5018"
    },
    {
      "name": "CVE-2008-6589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6589"
    },
    {
      "name": "CVE-2020-1656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1656"
    },
    {
      "name": "CVE-2019-11479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11479"
    },
    {
      "name": "CVE-2020-1665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1665"
    },
    {
      "name": "CVE-2016-6153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6153"
    },
    {
      "name": "CVE-2015-3717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3717"
    },
    {
      "name": "CVE-2019-11477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11477"
    },
    {
      "name": "CVE-2017-15286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15286"
    },
    {
      "name": "CVE-2020-1660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1660"
    },
    {
      "name": "CVE-2019-6593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6593"
    },
    {
      "name": "CVE-2008-6593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6593"
    },
    {
      "name": "CVE-2019-16168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16168"
    },
    {
      "name": "CVE-2008-6590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6590"
    },
    {
      "name": "CVE-2019-5610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5610"
    },
    {
      "name": "CVE-2019-9937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-9937"
    },
    {
      "name": "CVE-2017-10989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-10989"
    },
    {
      "name": "CVE-2020-1662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1662"
    },
    {
      "name": "CVE-2018-20505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20505"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-645",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nJuniper. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11055 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11055\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11050 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11050\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11079 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11079\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11053 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11053\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11059 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11059\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11049 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11049\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11046 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11046\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11048 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11048\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11057 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11057\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11054 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11054\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11062 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11062\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11056 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11056\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11045 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11045\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11058 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11058\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11047 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11047\u0026cat=SIRT_1\u0026actp=LIST"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eApple iOS versions ant\u00e9rieures \u00e0 9\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2015-5817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5817"
    },
    {
      "name": "CVE-2015-5880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5880"
    },
    {
      "name": "CVE-2015-5844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5844"
    },
    {
      "name": "CVE-2015-5793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5793"
    },
    {
      "name": "CVE-2015-5885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5885"
    },
    {
      "name": "CVE-2015-5851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5851"
    },
    {
      "name": "CVE-2015-5906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5906"
    },
    {
      "name": "CVE-2015-5816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5816"
    },
    {
      "name": "CVE-2015-5797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5797"
    },
    {
      "name": "CVE-2015-5867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5867"
    },
    {
      "name": "CVE-2015-5792",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5792"
    },
    {
      "name": "CVE-2015-0286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-0286"
    },
    {
      "name": "CVE-2015-5523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5523"
    },
    {
      "name": "CVE-2015-5767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5767"
    },
    {
      "name": "CVE-2015-5860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5860"
    },
    {
      "name": "CVE-2015-5788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5788"
    },
    {
      "name": "CVE-2015-5824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5824"
    },
    {
      "name": "CVE-2015-5522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5522"
    },
    {
      "name": "CVE-2015-5892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5892"
    },
    {
      "name": "CVE-2015-5863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5863"
    },
    {
      "name": "CVE-2015-5822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5822"
    },
    {
      "name": "CVE-2015-5840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5840"
    },
    {
      "name": "CVE-2015-5845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5845"
    },
    {
      "name": "CVE-2015-5868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5868"
    },
    {
      "name": "CVE-2015-5861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5861"
    },
    {
      "name": "CVE-2015-5835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5835"
    },
    {
      "name": "CVE-2015-5874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5874"
    },
    {
      "name": "CVE-2015-5789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5789"
    },
    {
      "name": "CVE-2015-5748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5748"
    },
    {
      "name": "CVE-2015-1129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-1129"
    },
    {
      "name": "CVE-2015-5850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5850"
    },
    {
      "name": "CVE-2015-5904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5904"
    },
    {
      "name": "CVE-2015-5858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5858"
    },
    {
      "name": "CVE-2015-5843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5843"
    },
    {
      "name": "CVE-2015-5806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5806"
    },
    {
      "name": "CVE-2015-5895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5895"
    },
    {
      "name": "CVE-2015-5805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5805"
    },
    {
      "name": "CVE-2015-5827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5827"
    },
    {
      "name": "CVE-2014-8611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8611"
    },
    {
      "name": "CVE-2015-5879",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5879"
    },
    {
      "name": "CVE-2015-5765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5765"
    },
    {
      "name": "CVE-2015-5896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5896"
    },
    {
      "name": "CVE-2015-5764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5764"
    },
    {
      "name": "CVE-2015-5811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5811"
    },
    {
      "name": "CVE-2015-5829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5829"
    },
    {
      "name": "CVE-2015-5839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5839"
    },
    {
      "name": "CVE-2015-5834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5834"
    },
    {
      "name": "CVE-2015-1205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-1205"
    },
    {
      "name": "CVE-2015-5898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5898"
    },
    {
      "name": "CVE-2015-5819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5819"
    },
    {
      "name": "CVE-2015-5905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5905"
    },
    {
      "name": "CVE-2015-5856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5856"
    },
    {
      "name": "CVE-2015-5882",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5882"
    },
    {
      "name": "CVE-2015-5921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5921"
    },
    {
      "name": "CVE-2015-5810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5810"
    },
    {
      "name": "CVE-2015-5804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5804"
    },
    {
      "name": "CVE-2015-5831",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5831"
    },
    {
      "name": "CVE-2015-5869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5869"
    },
    {
      "name": "CVE-2015-5862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5862"
    },
    {
      "name": "CVE-2015-5818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5818"
    },
    {
      "name": "CVE-2015-5807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5807"
    },
    {
      "name": "CVE-2015-5802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5802"
    },
    {
      "name": "CVE-2015-5876",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5876"
    },
    {
      "name": "CVE-2015-5912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5912"
    },
    {
      "name": "CVE-2015-5814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5814"
    },
    {
      "name": "CVE-2015-5842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5842"
    },
    {
      "name": "CVE-2015-5803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5803"
    },
    {
      "name": "CVE-2015-5812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5812"
    },
    {
      "name": "CVE-2015-0287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-0287"
    },
    {
      "name": "CVE-2015-5857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5857"
    },
    {
      "name": "CVE-2015-5791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5791"
    },
    {
      "name": "CVE-2015-5825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5825"
    },
    {
      "name": "CVE-2015-5841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5841"
    },
    {
      "name": "CVE-2015-5846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5846"
    },
    {
      "name": "CVE-2015-5823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5823"
    },
    {
      "name": "CVE-2015-5916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5916"
    },
    {
      "name": "CVE-2015-5838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5838"
    },
    {
      "name": "CVE-2015-5826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5826"
    },
    {
      "name": "CVE-2015-5801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5801"
    },
    {
      "name": "CVE-2015-5899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5899"
    },
    {
      "name": "CVE-2015-5847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5847"
    },
    {
      "name": "CVE-2015-5800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5800"
    },
    {
      "name": "CVE-2015-5813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5813"
    },
    {
      "name": "CVE-2015-5795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5795"
    },
    {
      "name": "CVE-2015-5903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5903"
    },
    {
      "name": "CVE-2015-5848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5848"
    },
    {
      "name": "CVE-2015-5799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5799"
    },
    {
      "name": "CVE-2015-5794",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5794"
    },
    {
      "name": "CVE-2015-5820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5820"
    },
    {
      "name": "CVE-2015-5790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5790"
    },
    {
      "name": "CVE-2015-5809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5809"
    },
    {
      "name": "CVE-2015-5907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5907"
    },
    {
      "name": "CVE-2015-5832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5832"
    },
    {
      "name": "CVE-2015-5837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5837"
    },
    {
      "name": "CVE-2013-3951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-3951"
    },
    {
      "name": "CVE-2015-5796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5796"
    },
    {
      "name": "CVE-2015-5855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5855"
    },
    {
      "name": "CVE-2015-3801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3801"
    },
    {
      "name": "CVE-2015-5821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5821"
    },
    {
      "name": "CVE-2014-8146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8146"
    }
  ],
  "links": [],
  "reference": "CERTFR-2015-AVI-393",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2015-09-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple iOS\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par\nl\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de\nservice \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple iOS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT205212 du 16 septembre 2015",
      "url": "https://support.apple.com/fr-fr/HT205212"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Junos OS NFX Series versions ant\u00e9rieures \u00e0 20.2R1",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions ant\u00e9rieures \u00e0 12.3R12-S16, 12.3X48-D105, 14.1X53-D53, 15.1R7-S8, 15.1X49-D220, 15.1X53-D593, 16.1R7-S8, 16.2R2-S11, 17.1R2-S11, 17.2R3-S4, 17.2X75-D45, 17.3R3-S9, 17.4R2-S12, 17.4R3-S3, 18.1R3-S10, 18.2R2-S7, 18.2R3S6, 18.2X75-D435, 18.3R1-S7, 18.3R2-S4, 18.3R3-S3, 18.4R1-S7, 18.4R2-S5, 18.4R3-S4, 19.1R1-S5, 19.1R2-S2, 19.1R3-S2, 19.2R1-S5, 19.2R2, 19.3R2-S3, 19.3R3, 19.4R1-S3, 19.4R2-S1, 19.4R3, 20.1R1-S2, 20.1R2, 20.2R1",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Secure Analytics versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "Secure Analytics",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Networks Junos Space et Junos Space Security Director versions ant\u00e9rieures \u00e0 20.2R1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS MX series et EX9200 Series versions ant\u00e9rieures \u00e0 17.2R3-S4, 17.2X75-D102, 17.2X75-D110, 17.3R3-S8, 17.4R2-S11, 17.4R3-S2, 18.2R2-S7, 18.2R3, 18.2R3-S3, 18.2X75-D30, 18.3R2-S4, 18.3R3-S2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Juniper Networks Junos OS Evolved versions ant\u00e9rieures \u00e0 20.1R2-EVO",
      "product": {
        "name": "Networks Junos OS Evolved",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS NFX150, SRX1500, SRX4100, SRX4200, vSRX versions ant\u00e9rieures \u00e0 15.1X49-D220, 17.4R3-S3, 18.1R3-S11, 18.2R3-S5, 18.3R2-S4, 18.3R3-S3, 18.4R2-S5, 18.4R3-S4, 19.1R3-S2, 19.2R1-S5, 19.2R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS SRX Series versions ant\u00e9rieures \u00e0 12.3X48-D90, 15.1X49-D190, 17.4R2-S9, 17.4R3, 18.1R3-S9, 18.2R3, 18.3R1-S7, 18.3R2-S3, 18.3R3, 18.4R1-S6, 18.4R2-S3, 18.4R3, 19.1R1-S4, 19.1R2",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS MX Series versions ant\u00e9rieures \u00e0 17.3R3-S8, 18.3R3-S1, 18.4R3, 19.1R3, 19.2R2, 19.3R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-1661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1661"
    },
    {
      "name": "CVE-2020-7450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7450"
    },
    {
      "name": "CVE-2015-3416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3416"
    },
    {
      "name": "CVE-2019-15875",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-15875"
    },
    {
      "name": "CVE-2015-3415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3415"
    },
    {
      "name": "CVE-2019-11478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11478"
    },
    {
      "name": "CVE-2008-6592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6592"
    },
    {
      "name": "CVE-2019-9936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-9936"
    },
    {
      "name": "CVE-2020-1657",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1657"
    },
    {
      "name": "CVE-2020-1682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1682"
    },
    {
      "name": "CVE-2019-5599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5599"
    },
    {
      "name": "CVE-2013-7443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-7443"
    },
    {
      "name": "CVE-2018-8740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8740"
    },
    {
      "name": "CVE-2015-6607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-6607"
    },
    {
      "name": "CVE-2018-20506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20506"
    },
    {
      "name": "CVE-2018-20346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20346"
    },
    {
      "name": "CVE-2015-5895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5895"
    },
    {
      "name": "CVE-2015-3414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3414"
    },
    {
      "name": "CVE-2019-11135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11135"
    },
    {
      "name": "CVE-2020-10188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10188"
    },
    {
      "name": "CVE-2019-8457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8457"
    },
    {
      "name": "CVE-2017-13685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-13685"
    },
    {
      "name": "CVE-2019-5018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5018"
    },
    {
      "name": "CVE-2008-6589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6589"
    },
    {
      "name": "CVE-2020-1656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1656"
    },
    {
      "name": "CVE-2019-11479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11479"
    },
    {
      "name": "CVE-2020-1665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1665"
    },
    {
      "name": "CVE-2016-6153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6153"
    },
    {
      "name": "CVE-2015-3717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3717"
    },
    {
      "name": "CVE-2019-11477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11477"
    },
    {
      "name": "CVE-2017-15286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15286"
    },
    {
      "name": "CVE-2020-1660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1660"
    },
    {
      "name": "CVE-2019-6593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6593"
    },
    {
      "name": "CVE-2008-6593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6593"
    },
    {
      "name": "CVE-2019-16168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16168"
    },
    {
      "name": "CVE-2008-6590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6590"
    },
    {
      "name": "CVE-2019-5610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5610"
    },
    {
      "name": "CVE-2019-9937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-9937"
    },
    {
      "name": "CVE-2017-10989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-10989"
    },
    {
      "name": "CVE-2020-1662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1662"
    },
    {
      "name": "CVE-2018-20505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20505"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-645",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nJuniper. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11055 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11055\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11050 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11050\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11079 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11079\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11053 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11053\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11059 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11059\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11049 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11049\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11046 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11046\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11048 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11048\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11057 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11057\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11054 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11054\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11062 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11062\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11056 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11056\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11045 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11045\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11058 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11058\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11047 du 14 octobre 2020",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11047\u0026cat=SIRT_1\u0026actp=LIST"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eApple iOS versions ant\u00e9rieures \u00e0 9\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2015-5817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5817"
    },
    {
      "name": "CVE-2015-5880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5880"
    },
    {
      "name": "CVE-2015-5844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5844"
    },
    {
      "name": "CVE-2015-5793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5793"
    },
    {
      "name": "CVE-2015-5885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5885"
    },
    {
      "name": "CVE-2015-5851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5851"
    },
    {
      "name": "CVE-2015-5906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5906"
    },
    {
      "name": "CVE-2015-5816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5816"
    },
    {
      "name": "CVE-2015-5797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5797"
    },
    {
      "name": "CVE-2015-5867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5867"
    },
    {
      "name": "CVE-2015-5792",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5792"
    },
    {
      "name": "CVE-2015-0286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-0286"
    },
    {
      "name": "CVE-2015-5523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5523"
    },
    {
      "name": "CVE-2015-5767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5767"
    },
    {
      "name": "CVE-2015-5860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5860"
    },
    {
      "name": "CVE-2015-5788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5788"
    },
    {
      "name": "CVE-2015-5824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5824"
    },
    {
      "name": "CVE-2015-5522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5522"
    },
    {
      "name": "CVE-2015-5892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5892"
    },
    {
      "name": "CVE-2015-5863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5863"
    },
    {
      "name": "CVE-2015-5822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5822"
    },
    {
      "name": "CVE-2015-5840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5840"
    },
    {
      "name": "CVE-2015-5845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5845"
    },
    {
      "name": "CVE-2015-5868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5868"
    },
    {
      "name": "CVE-2015-5861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5861"
    },
    {
      "name": "CVE-2015-5835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5835"
    },
    {
      "name": "CVE-2015-5874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5874"
    },
    {
      "name": "CVE-2015-5789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5789"
    },
    {
      "name": "CVE-2015-5748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5748"
    },
    {
      "name": "CVE-2015-1129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-1129"
    },
    {
      "name": "CVE-2015-5850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5850"
    },
    {
      "name": "CVE-2015-5904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5904"
    },
    {
      "name": "CVE-2015-5858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5858"
    },
    {
      "name": "CVE-2015-5843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5843"
    },
    {
      "name": "CVE-2015-5806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5806"
    },
    {
      "name": "CVE-2015-5895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5895"
    },
    {
      "name": "CVE-2015-5805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5805"
    },
    {
      "name": "CVE-2015-5827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5827"
    },
    {
      "name": "CVE-2014-8611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8611"
    },
    {
      "name": "CVE-2015-5879",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5879"
    },
    {
      "name": "CVE-2015-5765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5765"
    },
    {
      "name": "CVE-2015-5896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5896"
    },
    {
      "name": "CVE-2015-5764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5764"
    },
    {
      "name": "CVE-2015-5811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5811"
    },
    {
      "name": "CVE-2015-5829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5829"
    },
    {
      "name": "CVE-2015-5839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5839"
    },
    {
      "name": "CVE-2015-5834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5834"
    },
    {
      "name": "CVE-2015-1205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-1205"
    },
    {
      "name": "CVE-2015-5898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5898"
    },
    {
      "name": "CVE-2015-5819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5819"
    },
    {
      "name": "CVE-2015-5905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5905"
    },
    {
      "name": "CVE-2015-5856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5856"
    },
    {
      "name": "CVE-2015-5882",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5882"
    },
    {
      "name": "CVE-2015-5921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5921"
    },
    {
      "name": "CVE-2015-5810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5810"
    },
    {
      "name": "CVE-2015-5804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5804"
    },
    {
      "name": "CVE-2015-5831",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5831"
    },
    {
      "name": "CVE-2015-5869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5869"
    },
    {
      "name": "CVE-2015-5862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5862"
    },
    {
      "name": "CVE-2015-5818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5818"
    },
    {
      "name": "CVE-2015-5807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5807"
    },
    {
      "name": "CVE-2015-5802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5802"
    },
    {
      "name": "CVE-2015-5876",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5876"
    },
    {
      "name": "CVE-2015-5912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5912"
    },
    {
      "name": "CVE-2015-5814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5814"
    },
    {
      "name": "CVE-2015-5842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5842"
    },
    {
      "name": "CVE-2015-5803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5803"
    },
    {
      "name": "CVE-2015-5812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5812"
    },
    {
      "name": "CVE-2015-0287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-0287"
    },
    {
      "name": "CVE-2015-5857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5857"
    },
    {
      "name": "CVE-2015-5791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5791"
    },
    {
      "name": "CVE-2015-5825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5825"
    },
    {
      "name": "CVE-2015-5841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5841"
    },
    {
      "name": "CVE-2015-5846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5846"
    },
    {
      "name": "CVE-2015-5823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5823"
    },
    {
      "name": "CVE-2015-5916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5916"
    },
    {
      "name": "CVE-2015-5838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5838"
    },
    {
      "name": "CVE-2015-5826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5826"
    },
    {
      "name": "CVE-2015-5801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5801"
    },
    {
      "name": "CVE-2015-5899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5899"
    },
    {
      "name": "CVE-2015-5847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5847"
    },
    {
      "name": "CVE-2015-5800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5800"
    },
    {
      "name": "CVE-2015-5813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5813"
    },
    {
      "name": "CVE-2015-5795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5795"
    },
    {
      "name": "CVE-2015-5903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5903"
    },
    {
      "name": "CVE-2015-5848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5848"
    },
    {
      "name": "CVE-2015-5799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5799"
    },
    {
      "name": "CVE-2015-5794",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5794"
    },
    {
      "name": "CVE-2015-5820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5820"
    },
    {
      "name": "CVE-2015-5790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5790"
    },
    {
      "name": "CVE-2015-5809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5809"
    },
    {
      "name": "CVE-2015-5907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5907"
    },
    {
      "name": "CVE-2015-5832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5832"
    },
    {
      "name": "CVE-2015-5837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5837"
    },
    {
      "name": "CVE-2013-3951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-3951"
    },
    {
      "name": "CVE-2015-5796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5796"
    },
    {
      "name": "CVE-2015-5855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5855"
    },
    {
      "name": "CVE-2015-3801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-3801"
    },
    {
      "name": "CVE-2015-5821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5821"
    },
    {
      "name": "CVE-2014-8146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8146"
    }
  ],
  "links": [],
  "reference": "CERTFR-2015-AVI-393",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2015-09-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple iOS\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par\nl\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de\nservice \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple iOS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT205212 du 16 septembre 2015",
      "url": "https://support.apple.com/fr-fr/HT205212"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "76108C0E-2392-4FF1-B092-DD933BF4D135",
              "versionEndIncluding": "3.8.10.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED0C640E-6836-4C93-BBB3-84B61E5EBB7B",
              "versionEndIncluding": "8.4.1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades no especificadas en SQLite en versiones anteriores a 3.8.10.2, tal como se utiliza en Apple iOS en versiones anteriores a 9, tiene un impacto y vectores de ataque desconocidos."
    }
  ],
  "id": "CVE-2015-5895",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-09-18T12:00:24.747",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securityfocus.com/bid/76764"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securitytracker.com/id/1033609"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT205212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/76764"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1033609"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT205212"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2015-5895",
    "description": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.",
    "id": "GSD-2015-5895"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-5895"
      ],
      "details": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.",
      "id": "GSD-2015-5895",
      "modified": "2023-12-13T01:20:06.626984Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "product-security@apple.com",
        "ID": "CVE-2015-5895",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "1033609",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1033609"
          },
          {
            "name": "https://support.apple.com/HT205212",
            "refsource": "CONFIRM",
            "url": "https://support.apple.com/HT205212"
          },
          {
            "name": "76764",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/76764"
          },
          {
            "name": "APPLE-SA-2015-09-16-1",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "3.8.10.1",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "8.4.1",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2015-5895"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "APPLE-SA-2015-09-16-1",
              "refsource": "APPLE",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html"
            },
            {
              "name": "https://support.apple.com/HT205212",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://support.apple.com/HT205212"
            },
            {
              "name": "76764",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/76764"
            },
            {
              "name": "1033609",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1033609"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": true,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2016-12-22T03:00Z",
      "publishedDate": "2015-09-18T12:00Z"
    }
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201509-0038",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sqlite",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sqlite",
        "version": "3.8.10.1"
      },
      {
        "model": "sqlite",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "sqlite",
        "version": "3.8.10.2"
      },
      {
        "model": "ios",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "apple",
        "version": "9   (ipad 2 or later )"
      },
      {
        "model": "ios",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "apple",
        "version": "9   (iphone 4s or later )"
      },
      {
        "model": "ios",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "apple",
        "version": "9   (ipod touch first  5 after generation )"
      },
      {
        "model": "sqlite",
        "scope": "eq",
        "trust": 0.7,
        "vendor": "sqlite",
        "version": "3.8.10.1"
      },
      {
        "model": "ipod touch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "0"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "0"
      },
      {
        "model": "ipad",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "0"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3.5"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3.4"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3.3"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.3"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.9"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.8"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.7"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.6"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.5"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2.10"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "BID",
        "id": "76764"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "3.8.10.1",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "8.4.1",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Xiaofeng Zheng, Tsinghua University, Sam Greenhalgh, Andreas Kurtz, Erling Ellingsen, Amit Klein, Timothy J. Wood, Jin Han, Su Mon Kywe, Qiang Yan, Robert Deng, Debin Gao, Yingjiu Li, Feng Bao and Jianying Zhou, 1x7e1, beist of grayhash, Filippo Bigarella,",
    "sources": [
      {
        "db": "BID",
        "id": "76764"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-5895",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": true,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2015-5895",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-83856",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2015-5895",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201509-353",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-83856",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-5895",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. \nAttackers can exploit these issues to bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial-of-service condition, perform unauthorized actions and gain system privileges; this may aid in launching further attacks. \nVersions prior to iOS 9 are vulnerable. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. SQLite is an open source embedded relational database management system based on C language developed by American software developer D.Richard Hipp. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2015-09-21-1 watchOS 2\n\nwatchOS 2 is now available and addresses the following:\n\nApple Pay\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Some cards may allow a terminal to retrieve limited recent\ntransaction information when making a payment\nDescription:  The transaction log functionality was enabled in\ncertain configurations. This issue was addressed by removing the\ntransaction log functionality. \nCVE-ID\nCVE-2015-5916\n\nAudio\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Playing a malicious audio file may lead to an unexpected\napplication termination\nDescription:  A memory corruption issue existed in the handling of\naudio files. This issue issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.:\nProf. Taekyoung Kwon), Yonsei University, Seoul, Korea\n\nCertificate Trust Policy\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Update to the certificate trust policy\nDescription:  The certificate trust policy was updated. The complete\nlist of certificates may be viewed at https://support.apple.com/en-\nus/HT204873. \n\nCFNetwork\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  An attacker with a privileged network position may intercept\nSSL/TLS connections\nDescription:  A certificate validation issue existed in NSURL when a\ncertificate changed. This issue was addressed through improved\ncertificate validation. \nCVE-ID\nCVE-2015-5824 : Timothy J. Wood of The Omni Group\n\nCFNetwork\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Connecting to a malicious web proxy may set malicious\ncookies for a website\nDescription:  An issue existed in the handling of proxy connect\nresponses. This issue was addressed by removing the set-cookie header\nwhile parsing the connect response. \nCVE-ID\nCVE-2015-5841 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua\nUniversity\n\nCFNetwork\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  An attacker in a privileged network position can track a\nuser\u0027s activity\nDescription:  A cross-domain cookie issue existed in the handling of\ntop level domains. The issue was address through improved\nrestrictions of cookie creation\nCVE-ID\nCVE-2015-5885 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua\nUniversity\n\nCFNetwork\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Malicious FTP servers may be able to cause the client to\nperform reconnaissance on other hosts\nDescription:  An issue existed in FTP clients while checking when\nproxy was in use. This issue was resolved through improved\nvalidation. \nCVE-ID\nCVE-2015-5912 : Amit Klein\n\nCFNetwork\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A person with physical access to an iOS device may read\ncache data from Apple apps\nDescription:  Cache data was encrypted with a key protected only by\nthe hardware UID. This issue was addressed by encrypting the cache\ndata with a key protected by the hardware UID and the user\u0027s\npasscode. \nCVE-ID\nCVE-2015-5898 : Andreas Kurtz of NESO Security Labs\n\nCoreCrypto\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  An attacker may be able to determine a private key\nDescription:  By observing many signing or decryption attempts, an\nattacker may have been able to determine the RSA private key. This\nissue was addressed using improved encryption algorithms. \n\nCoreText\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team\n\nData Detectors Engine\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Processing a maliciously crafted text file may lead to\narbitrary code execution\nDescription:  Memory corruption issues existed in the processing of\ntext files. These issues were addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2015-5829 : M1x7e1 of Safeye Team (www.safeye.org)\n\nDev Tools\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A memory corruption issue existed in dyld. This was\naddressed through improved memory handling. \nCVE-ID\nCVE-2015-5876 : beist of grayhash\n\ndyld\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  An application may be able to bypass code signing\nDescription:  An issue existed with validation of the code signature\nof executables. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2015-5839 : @PanguTeam, TaiG Jailbreak Team\n\nDisk Images\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue existed in DiskImages. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5847 : Filippo Bigarella, Luca Todesco\n\nGasGauge\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues existed in the\nkernel. These issues were addressed through improved memory handling. \nCVE-ID\nCVE-2015-5918 : Apple\nCVE-2015-5919 : Apple\n\nICU\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Multiple vulnerabilities in ICU\nDescription:  Multiple vulnerabilities existed in ICU versions prior\nto 53.1.0. These issues were addressed by updating ICU to version\n55.1. \nCVE-ID\nCVE-2014-8146\nCVE-2015-1205\n\nIOAcceleratorFamily\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A malicious application may be able to determine kernel\nmemory layout\nDescription:  An issue existed that led to the disclosure of kernel\nmemory content. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2015-5834 : Cererdlong of Alibaba Mobile Security Team\n\nIOAcceleratorFamily\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue existed in\nIOAcceleratorFamily. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2015-5848 : Filippo Bigarella\n\nIOKit\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A memory corruption issue existed in the kernel. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5844 : Filippo Bigarella\nCVE-2015-5845 : Filippo Bigarella\nCVE-2015-5846 : Filippo Bigarella\n\nIOMobileFrameBuffer\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue existed in\nIOMobileFrameBuffer. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2015-5843 : Filippo Bigarella\n\nIOStorageFamily\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local attacker may be able to read kernel memory\nDescription:  A memory initialization issue existed in the kernel. \nThis issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5863 : Ilja van Sprundel of IOActive\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue existed in the kernel. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5868 : Cererdlong of Alibaba Mobile Security Team\nCVE-2015-5896 : Maxime Villard of m00nbsd\nCVE-2015-5903 : CESG\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local attacker may control the value of stack cookies\nDescription:  Multiple weaknesses existed in the generation of user\nspace stack cookies. This was addressed through improved generation\nof stack cookies. \nCVE-ID\nCVE-2013-3951 : Stefan Esser\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local process can modify other processes without\nentitlement checks\nDescription:  An issue existed where root processes using the\nprocessor_set_tasks API were allowed to retrieve the task ports of\nother processes. This issue was addressed through added entitlement\nchecks. \nCVE-ID\nCVE-2015-5882 : Pedro Vilaca, working from original research by Ming-\nchieh Pan and Sung-ting Tsai; Jonathan Levin\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  An attacker in a local LAN segment may disable IPv6 routing\nDescription:  An insufficient validation issue existed in handling of\nIPv6 router advertisements that allowed an attacker to set the hop\nlimit to an arbitrary value. This issue was addressed by enforcing a\nminimum hop limit. \nCVE-ID\nCVE-2015-5869 : Dennis Spindel Ljungmark\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to determine kernel memory layout\nDescription:  An issue existed in XNU that led to the disclosure of\nkernel memory. This was addressed through improved initialization of\nkernel memory structures. \nCVE-ID\nCVE-2015-5842 : beist of grayhash\n\nKernel\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to cause a system denial of service\nDescription:  An issue existed in HFS drive mounting. This was\naddressed by additional validation checks. \nCVE-ID\nCVE-2015-5748 : Maxime Villard of m00nbsd\n\nlibpthread\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A local user may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue existed in the kernel. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5899 : Lufeng Li of Qihoo 360 Vulcan Team\n\nPluginKit\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  A malicious enterprise application can install extensions\nbefore the application has been trusted\nDescription:  An issue existed in the validation of extensions during\ninstallation. This was addressed through improved app verification. \nCVE-ID\nCVE-2015-5837 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of\nFireEye, Inc. \n\nremovefile\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Processing malicious data may lead to unexpected application\ntermination\nDescription:  An overflow fault existed in the checkint division\nroutines. This issue was addressed with improved division routines. \nThese issues were addressed by updating SQLite to version 3.8.10.2. \nCVE-ID\nCVE-2015-5895\n\ntidy\nAvailable for:  Apple Watch Sport, Apple Watch,\nand Apple Watch Edition\nImpact:  Visiting a maliciously crafted website may lead to arbitrary\ncode execution\nDescription:  A memory corruption issue existed in Tidy. This issues\nwas addressed through improved memory handling. \nCVE-ID\nCVE-2015-5522 : Fernando Munoz of NULLGroup.com\nCVE-2015-5523 : Fernando Munoz of NULLGroup.com\n\n\nInstallation note:\n\nInstructions on how to update your Apple Watch software are\navailable at https://support.apple.com/en-us/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app\non your iPhone and select \"My Watch \u003e General \u003e About\". \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\". \n\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBCAAGBQJWAD3JAAoJEBcWfLTuOo7tqhIP+wbrK4nNIHsCMFxr+c3JyvLQ\nQFIsKBJwODOwx8HXF7IVx5qOTUMooR+r2uCtpnB9tdhHeCKE4wl4IjJRKtNmuKo8\ncpCJP5jBDk1JGlms7htP9umRwa+J6o5BMiqJRYJWfUZKt5M180F1LwQRo5EexTYm\noWoDLwqNXU8gl6xXFNVNsWDtgvhalpT1eTYj2WDts0lnS9lnaTQIBipIlcH+9T8M\njOxZAaogwdN7F1WIP+DnoEI8f1rBPgq+WCY9hzYnRzIt8D7QPU3A9UVMPXRptlYD\nAUA5oynybu+72mlauHL4iZ4RJEMDQNDvCX0F3oDjJv9NxDnrNTYdVXor8IYffkXm\nu9byknmIKTwxR+FtMk7kS//C2PV8SGfigkvaYQt3OLEa3FeqwIl8+qtVF059QeBL\nWrBz0hcfOiB0mcm4CpDdtkNZCwROgyMgPv3vK5WqvcIDUe2rmCAP9XIuEgZDriCk\nU9A7pEwbcRaV3G9G9zCPQOxnXv/Ko2xjZPLEtcNvwBkel4Dd5nRQ5S7yyWF977Ds\nfx1pzFRtXDCTbjwDDN1XM78IV++nz8xQnaqh193Oq4a+GN3XeM70uE+dNpeOJiQh\nE/Cp9KI563FhoaZSR/01iiK8DD+YT/d6SnkWq02joP4VGvEpNzZ5Tv/68Peaw/QX\nW3j/7Rzc/PjuOCP0lDSI\n=PAVo\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "BID",
        "id": "76764"
      },
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "PACKETSTORM",
        "id": "133641"
      }
    ],
    "trust": 2.16
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-83856",
        "trust": 0.1,
        "type": "unknown"
      },
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=36190",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-5895",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "76764",
        "trust": 1.5
      },
      {
        "db": "SECTRACK",
        "id": "1033609",
        "trust": 1.2
      },
      {
        "db": "JVN",
        "id": "JVNVU99970459",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3573",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3573.2",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "36190",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-83856",
        "trust": 0.1
      },
      {
        "db": "TENABLE",
        "id": "TNS-2015-05",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "133641",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "BID",
        "id": "76764"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "PACKETSTORM",
        "id": "133641"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "id": "VAR-201509-0038",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:02:50.645000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Apple security updates",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht201222"
      },
      {
        "title": "APPLE-SA-2015-09-16-1 iOS 9",
        "trust": 0.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00001.html"
      },
      {
        "title": "HT205212",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht205212"
      },
      {
        "title": "HT205212",
        "trust": 0.8,
        "url": "http://support.apple.com/ja-jp/ht205212"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.sqlite.org/index.html"
      },
      {
        "title": "iTunes6464Setup",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57671"
      },
      {
        "title": "iPhone7,1_9.0_13A344_Restore",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57670"
      },
      {
        "title": "Tenable Security Advisories: [R4] Nessus 5.2.11 / 6.3.7 Fixes Third-party Library",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=tns-2015-05"
      },
      {
        "title": "LinuxFlaw",
        "trust": 0.1,
        "url": "https://github.com/mudongliang/linuxflaw "
      },
      {
        "title": "cve-",
        "trust": 0.1,
        "url": "https://github.com/oneoy/cve- "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.3,
        "url": "http://www.securityfocus.com/bid/76764"
      },
      {
        "trust": 1.2,
        "url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00001.html"
      },
      {
        "trust": 1.2,
        "url": "https://support.apple.com/ht205212"
      },
      {
        "trust": 1.2,
        "url": "http://www.securitytracker.com/id/1033609"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5895"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu99970459/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5895"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3573.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3573/"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/ios/"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/ipad/"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/iphone/"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/ipodtouch/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/36190/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.tenable.com/security/tns-2015-05"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5895"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-1205"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://www.safeye.org)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5916"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-us/ht204641"
      },
      {
        "trust": 0.1,
        "url": "http://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8146"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "BID",
        "id": "76764"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "PACKETSTORM",
        "id": "133641"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "db": "BID",
        "id": "76764"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "db": "PACKETSTORM",
        "id": "133641"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-09-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "date": "2015-09-18T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "date": "2015-09-16T00:00:00",
        "db": "BID",
        "id": "76764"
      },
      {
        "date": "2015-09-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "date": "2015-09-22T13:33:33",
        "db": "PACKETSTORM",
        "id": "133641"
      },
      {
        "date": "2015-09-18T12:00:24.747000",
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "date": "2015-09-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-12-22T00:00:00",
        "db": "VULHUB",
        "id": "VHN-83856"
      },
      {
        "date": "2016-12-22T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-5895"
      },
      {
        "date": "2015-11-03T19:44:00",
        "db": "BID",
        "id": "76764"
      },
      {
        "date": "2015-09-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      },
      {
        "date": "2016-12-22T03:00:10.903000",
        "db": "NVD",
        "id": "CVE-2015-5895"
      },
      {
        "date": "2020-10-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-353"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple iOS Used in  SQLite Vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004822"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unknown",
    "sources": [
      {
        "db": "BID",
        "id": "76764"
      }
    ],
    "trust": 0.3
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-5895"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-09-18T12:00:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.",
  "id": "GHSA-43r3-p9qg-f74p",
  "modified": "2022-05-17T03:19:05Z",
  "published": "2022-05-17T03:19:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5895"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT205212"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/76764"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1033609"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-5895"
    }
  },
  "description": "Apple iOS\u662f\u4e00\u6b3e\u8fd0\u884c\u5728\u82f9\u679ciPhone\u548ciPod touch\u8bbe\u5907\u4e0a\u7684\u6700\u65b0\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nApple iOS SQLite\u5b58\u5728\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "discovererName": "Apple",
  "formalWay": "Apple iOS 9.0\u5df2\u7ecf\u4fee\u590d\u8be5\u6f0f\u6d1e\uff0c\u5efa\u8bae\u7528\u6237\u4e0b\u8f7d\u66f4\u65b0\uff1a\r\nhttps://support.apple.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-06155",
  "openTime": "2015-09-23",
  "patchDescription": "Apple iOS\u662f\u4e00\u6b3e\u8fd0\u884c\u5728\u82f9\u679ciPhone\u548ciPod touch\u8bbe\u5907\u4e0a\u7684\u6700\u65b0\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Apple iOS SQLite\u5b58\u5728\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apple iOS SQLite\u5b58\u5728\u591a\u4e2a\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apple IOS \u003c9",
      "Apple SQLite \u003c3.8.10.2"
    ]
  },
  "referenceLink": "https://support.apple.com/en-us/HT205212",
  "serverity": "\u9ad8",
  "submitTime": "2015-09-20",
  "title": "Apple iOS SQLite\u5b58\u5728\u591a\u4e2a\u672a\u660e\u6f0f\u6d1e"
}